bitrat | 9793f3fe8e7f7653e9a89870e83514862813e1122cec46936c2a96d7e42ba070 | Triage

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2023 04:44

Sharing

Report Analysis Logs

General

Target

0f5f21c67715e3fb4587eae4b07e1ebe.exe
Size

3.8MB
MD5

0f5f21c67715e3fb4587eae4b07e1ebe
SHA1

a9a6c464a3a4ef2c48991bbc3fa922a8768ece08
SHA256

9793f3fe8e7f7653e9a89870e83514862813e1122cec46936c2a96d7e42ba070
SHA512

3c64f503fe8ca6a47bcccb937bb4195f7d8afb956cc1a545425a6c238f27aacc5bdacf42ce6165ba5a2a305ba8301fa77aa130e98fa87538530be2fb3ed85c54
SSDEEP

98304:d77Pmq33rE/JDLPWZADUGer7B6iY74M/WmlwXVZ4FB:5+R/eZADUXR

Score

10^/10

bitrat trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

apk.theworkpc.com:4920

Attributes

communication_password
32c93a52f919c37c05b22825e5a57a4a
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

0f5f21c67715e3fb4587eae4b07e1ebe.exe

pid	process
4764	0f5f21c67715e3fb4587eae4b07e1ebe.exe
4764	0f5f21c67715e3fb4587eae4b07e1ebe.exe
4764	0f5f21c67715e3fb4587eae4b07e1ebe.exe
4764	0f5f21c67715e3fb4587eae4b07e1ebe.exe
4764	0f5f21c67715e3fb4587eae4b07e1ebe.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0f5f21c67715e3fb4587eae4b07e1ebe.exe

description pid process

Token: SeShutdownPrivilege 4764 0f5f21c67715e3fb4587eae4b07e1ebe.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

0f5f21c67715e3fb4587eae4b07e1ebe.exe

pid process

4764 0f5f21c67715e3fb4587eae4b07e1ebe.exe
4764 0f5f21c67715e3fb4587eae4b07e1ebe.exe

C:\Users\Admin\AppData\Local\Temp\0f5f21c67715e3fb4587eae4b07e1ebe.exe
"C:\Users\Admin\AppData\Local\Temp\0f5f21c67715e3fb4587eae4b07e1ebe.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4764-136-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4764-137-0x0000000074D00000-0x0000000074D39000-memory.dmp

Filesize
228KB

Download
memory/4764-138-0x00000000750A0000-0x00000000750D9000-memory.dmp

Filesize
228KB

Download
memory/4764-139-0x00000000750A0000-0x00000000750D9000-memory.dmp

Filesize
228KB

Download